pysec - pysec-2021-876

PYSEC-2021-876

Vulnerability from pysec - Published: 2021-01-11 10:15 - Updated: 2023-11-07 20:24

Details

Versions of Apache DolphinScheduler prior to 1.3.2 allowed an ordinary user under any tenant to override another users password through the API interface.

Severity ?

6.5 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Impacted products

Name	purl
apache-dolphinscheduler	pkg:pypi/apache-dolphinscheduler

Aliases

CVE-2020-13922

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "apache-dolphinscheduler",
        "purl": "pkg:pypi/apache-dolphinscheduler"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.1.0",
        "0.1.1",
        "2.0.5",
        "2.0.5.1",
        "2.0.7",
        "3.0.0",
        "3.0.0a0",
        "3.0.0b1",
        "3.0.0b2",
        "3.0.1",
        "3.0.2",
        "3.1.0",
        "3.1.1",
        "4.0.0",
        "4.0.1",
        "4.0.2",
        "4.0.2.1",
        "4.0.2a1",
        "4.0.2a10",
        "4.0.2a11",
        "4.0.2a12",
        "4.0.2a2",
        "4.0.2a3",
        "4.0.2a4",
        "4.0.2a5",
        "4.0.2a6",
        "4.0.2a7",
        "4.0.2a8",
        "4.0.2a9",
        "4.0.3",
        "4.0.4"
      ]
    }
  ],
  "aliases": [
    "CVE-2020-13922"
  ],
  "details": "Versions of Apache DolphinScheduler prior to 1.3.2 allowed an ordinary user under any tenant to override another users password through the API interface.",
  "id": "PYSEC-2021-876",
  "modified": "2023-11-07T20:24:23.899306+00:00",
  "published": "2021-01-11T10:15:00+00:00",
  "references": [
    {
      "type": "WEB",
      "url": "https://www.mail-archive.com/announce%40apache.org/msg06076.html"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2020-13922 (GCVE-0-2020-13922)

Vulnerability from cvelistv5 – Published: 2021-01-11 09:40 – Updated: 2025-02-13 16:27

Title

Apache DolphinScheduler (incubating) Permission vulnerability

Summary

Versions of Apache DolphinScheduler prior to 1.3.2 allowed an ordinary user under any tenant to override another users password through the API interface.

Severity ?

No CVSS data available.

CWE

CWE-264 - Permissions, Privileges, and Access Controls

Assigner

apache

References

URL

Tags

https://www.mail-archive.com/announce%40apache.or…

x_refsource_MISC

Impacted products

	Vendor	Product	Version
	Apache Software Foundation	Apache DolphinScheduler	Affected: Apache DolphinScheduler , < 1.3.2 (custom)

Credits

This issue was discovered by xuxiang of DtDream security

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T12:32:14.208Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.mail-archive.com/announce%40apache.org/msg06076.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Apache DolphinScheduler",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "1.3.2",
              "status": "affected",
              "version": "Apache DolphinScheduler",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "This issue was discovered by xuxiang of DtDream security"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Versions of Apache DolphinScheduler prior to 1.3.2 allowed an ordinary user under any tenant to override another users password through the API interface."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-264",
              "description": "CWE-264 Permissions, Privileges, and Access Controls",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-08-04T12:34:05.000Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.mail-archive.com/announce%40apache.org/msg06076.html"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache DolphinScheduler (incubating) Permission vulnerability",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@apache.org",
          "ID": "CVE-2020-13922",
          "STATE": "PUBLIC",
          "TITLE": "Apache DolphinScheduler (incubating) Permission vulnerability"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Apache DolphinScheduler",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "Apache DolphinScheduler",
                            "version_value": "1.3.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Apache Software Foundation"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "This issue was discovered by xuxiang of DtDream security"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Versions of Apache DolphinScheduler prior to 1.3.2 allowed an ordinary user under any tenant to override another users password through the API interface."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-264 Permissions, Privileges, and Access Controls"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.mail-archive.com/announce@apache.org/msg06076.html",
              "refsource": "MISC",
              "url": "https://www.mail-archive.com/announce@apache.org/msg06076.html"
            }
          ]
        },
        "source": {
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2020-13922",
    "datePublished": "2021-01-11T09:40:19.000Z",
    "dateReserved": "2020-06-08T00:00:00.000Z",
    "dateUpdated": "2025-02-13T16:27:28.158Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

PYSEC-2021-876

CVE-2020-13922 (GCVE-0-2020-13922)

Tags

Sightings

Nomenclature